424
CVEs
61
Critical
161
High
1
KEV
53
PoC
72
Unpatched C/H
64.4%
Patch Rate
0.9%
Avg EPSS
Severity Breakdown
CRITICAL
61
HIGH
161
MEDIUM
175
LOW
27
Monthly CVE Trend
Affected Products (30)
Vault
73
Nomad
35
Enterprise Vault
16
Consul Enterprise
12
Tooling
9
Kubernetes
9
Go Getter
9
Docker
8
Openbao
7
Remote Desktop Manager
7
Server
7
Boundary
6
Vault Enterprise
6
Terraform Enterprise
6
Cryptomator
6
Python
5
Terraform
5
Audit Vault And Database Firewall
5
Edge Virtualization Engine
4
Vagrant Vmware Fusion
4
Vagrant
4
1Password
4
Devolutions Server
4
Syspass
3
Go Slug
3
Atlantis
3
Rios
3
Camel
3
Managed File Transfer Command Center
3
Nomad Enterprise
3
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-45321 | Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actions exploitation. Attackers combined pull_request_target misconfiguration, Actions cache poisoning, and OIDC token memory extraction to publish malicious code under the legitimate TanStack identity. Installing any affected version executes a 2.3 MB obfuscated payload that exfiltrates AWS/GCP/Kubernetes credentials, npm tokens, GitHub secrets, SSH keys, and HashiCorp Vault tokens over encrypted Session/Oxen messenger infrastructure. The payload propagates by republishing victim-maintained packages with identical injection. Socket.dev and the TanStack team confirmed the incident via GHSA-g7cv-rxg3-hmpx. No EPSS or CISA KEV data available for this recent supply-chain attack. CVSS 9.6 reflects the cross-scope credential theft impact (S:C/C:H/I:H), though exploitation requires user-initiated package installation (UI:R). | CRITICAL | 9.6 | 0.0% | 118 |
KEV
PoC
|
| CVE-2026-34976 | Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks against Dgraph graph database servers (v24.x, v25.x prior to v25.3.1) via the admin API's restoreTenant mutation. The mutation bypasses all authentication middleware due to missing authorization configuration, allowing attackers to provide arbitrary backup source URLs (including file:// schemes for local filesystem access), S3/MinIO credentials, Vault configuration paths, and encry | CRITICAL | 10.0 | 0.0% | 70 |
PoC
|
| CVE-2018-9843 | The REST API in CyberArk Password Vault Web Access before 9.9.5 and 10.x before 10.1 allows remote attackers to execute arbitrary code via a serialized .NET object in an Authorization HTTP header. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 17.3% | 69 |
PoC
No patch
|
| CVE-2018-20371 | PhotoRange Photo Vault 1.2 appends the password to the URI for authorization, which makes it easier for remote attackers to bypass intended GET restrictions via a brute-force approach, as. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 1.6% | 69 |
PoC
No patch
|
| CVE-2019-7442 | An XML external entity (XXE) vulnerability in the Password Vault Web Access (PVWA) of CyberArk Enterprise Password Vault <=10.7 allows remote attackers to read arbitrary files or potentially bypass. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 40.0% | 69 |
PoC
No patch
|
| CVE-2021-30476 | HashiCorp Terraform’s Vault Provider (terraform-provider-vault) did not correctly configure GCE-type bound labels for Vault’s GCP auth method. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 1.6% | 69 |
PoC
No patch
|
| CVE-2026-54725 | Server-side request forgery in bank-vaults vault-secrets-webhook (<= 1.22.2) lets a low-privileged tenant with ConfigMap or Secret create/update rights in any watched namespace force the cluster-wide admission webhook to make attacker-controlled outbound HTTP requests and exfiltrate ServiceAccount JWTs. The webhook trusts the vault.security.banzaicloud.io/vault-addr annotation with no scheme validation or host allowlist, then synchronously mints a SA token (via cluster-wide serviceaccounts/token:create) and POSTs it to the attacker's address, which can be replayed against the real Vault. A vendor patch (v1.23.1) exists and the reporter published a working PoC, but there is no public exploit identified in the wild and the flaw is not in CISA KEV. | CRITICAL | 9.6 | 0.3% | 68 |
PoC
|
| CVE-2026-60104 | Account takeover in self-hosted Bitwarden Server before 2026.6.0 lets a low-privileged organization member steal any other member's vault key and a victim-scoped access token. The POST /auth-requests/admin-request handler never verifies that the email in the request body belongs to the authenticated caller (CWE-639), so an attacker can create a Trusted Device Encryption admin-approval request for a victim, bound to an attacker-controlled public key; once approved, the encrypted key material is retrievable from an unauthenticated endpoint. Publicly available exploit code exists (a VulnCheck advisory plus a public write-up), and the CVSS 4.0 base score of 9.3 reflects high confidentiality and integrity impact plus a cross-user scope change. | CRITICAL | 9.3 | 0.2% | 67 |
PoC
|
| CVE-2020-16271 | The SRP-6a implementation in Kee Vault KeePassRPC before 1.12.0 generates insufficiently random numbers, which allows remote attackers to read and modify data in the KeePass database via a WebSocket. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.1 | 1.5% | 66 |
PoC
No patch
|
| CVE-2020-16272 | The SRP-6a implementation in Kee Vault KeePassRPC before 1.12.0 is missing validation for a client-provided parameter, which allows remote attackers to read and modify data in the KeePass database. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.1 | 2.8% | 66 |
PoC
No patch
|
| CVE-2021-43837 | vault-cli is a configurable command-line interface tool (and python library) to interact with Hashicorp Vault. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available. | CRITICAL | 9.1 | 5.0% | 66 |
PoC
|
| CVE-2026-53727 | Server-side request forgery in the Ruby css_parser gem (< 3.0.0) lets a remote unauthenticated attacker force the parsing server to issue arbitrary HTTP/HTTPS GET requests, and via an attacker-controlled 3xx redirect to a file:// URI, escalate to arbitrary local file disclosure. The flaw sits in CssParser::Parser#read_remote_file, reachable through load_uri! and any add_block! call that supplies base_uri: - Premailer being the canonical consumer - so a single attacker-planted @import url(...) in parsed CSS reaches the sink. Publicly available exploit code exists (author-supplied PoC); there is no public exploit identified as being used in active campaigns, and it is not listed in CISA KEV. | HIGH | 8.9 | 0.5% | 65 |
PoC
|
| CVE-2017-11741 | HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) before 4.0.24 uses weak permissions for the sudo helper scripts, allows local users to execute arbitrary code with root privileges. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 0.3% | 64 |
PoC
No patch
|
| CVE-2026-70619 | Missing admin authorization on the embedding management API in Odysseus allows any authenticated non-admin user to overwrite or delete the server-wide embedding backend configuration, redirecting all subsequent embedding operations - including chat messages, RAG queries, memory entries, and vault text - in plaintext to an attacker-controlled URL. All deployments running any version prior to commit bf325f6 are affected. A public exploit and detailed write-up are available, and the CVSS 4.0 score of 8.7 (PR:L) reflects the low barrier to exploitation for any account holder. | HIGH | 8.7 | 0.4% | 64 |
PoC
|
| CVE-2026-65709 | Missing object-level authorization in sysPass through 3.2.11 allows API token holders to enumerate account metadata, overwrite passwords, and delete any account across the vault without per-account access controls. A public proof-of-concept is available, though EPSS indicates low exploitation probability (0.22%). | HIGH | 8.7 | 0.2% | 64 |
PoC
No patch
|